Mailing List Archive

Odd Error Message from v8.2010
Group:

Can someone help me understand why sending this exact plain text to an rsyslog network listener…

2021-10-14T08:26:31.444-00:00

…results in this exact error message in the rsyslog log file?

2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: delimiter is not SP but has ASCII value 45. [v8.2102.0]


Yes, I know the priority and version are missing, but that doesn’t seem to explain why the error is occurring. Any help is greatly appreciated.

The input configuration is as follows…

input(type=“imptcp” name=“ptcp-51419-in” port=“51419” ruleset=“from_appname”)


Thanks in advance,
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Odd Error Message from v8.2010 [ In reply to ]
Oops. Subject should read… "Odd Error Message from v8.2102”



> On Oct 14, 2021, at 08:35, John Chivian via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> Group:
>
> Can someone help me understand why sending this exact plain text to an rsyslog network listener…
>
> 2021-10-14T08:26:31.444-00:00
>
> …results in this exact error message in the rsyslog log file?
>
> 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: delimiter is not SP but has ASCII value 45. [v8.2102.0]
>
>
> Yes, I know the priority and version are missing, but that doesn’t seem to explain why the error is occurring. Any help is greatly appreciated.
>
> The input configuration is as follows…
>
> input(type=“imptcp” name=“ptcp-51419-in” port=“51419” ruleset=“from_appname”)
>
>
> Thanks in advance,
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Odd Error Message from v8.2010 [ In reply to ]
I suspect it's looking for a space after the timestamp.

David Lang

On Thu, 14 Oct 2021, John Chivian via rsyslog wrote:

> Date: Thu, 14 Oct 2021 08:37:17 -0500
> From: John Chivian via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog-users <rsyslog@lists.adiscon.com>
> Cc: John Chivian <jchivian@chivian.com>
> Subject: Re: [rsyslog] Odd Error Message from v8.2010
>
> Oops. Subject should read… "Odd Error Message from v8.2102”
>
>
>
>> On Oct 14, 2021, at 08:35, John Chivian via rsyslog <rsyslog@lists.adiscon.com> wrote:
>>
>> Group:
>>
>> Can someone help me understand why sending this exact plain text to an rsyslog network listener…
>>
>> 2021-10-14T08:26:31.444-00:00
>>
>> …results in this exact error message in the rsyslog log file?
>>
>> 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: delimiter is not SP but has ASCII value 45. [v8.2102.0]
>>
>>
>> Yes, I know the priority and version are missing, but that doesn’t seem to explain why the error is occurring. Any help is greatly appreciated.
>>
>> The input configuration is as follows…
>>
>> input(type=“imptcp” name=“ptcp-51419-in” port=“51419” ruleset=“from_appname”)
>>
>>
>> Thanks in advance,
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Odd Error Message from v8.2010 [ In reply to ]
I need to check the code, but as "framing error" is quoted, and "pri
is missing" is said, I think the case is that 2021 is right at the
start of the message. That triggers octet-counted framing (message
terminated after n bytes/octets, not on LF). In that mode, a SP needs
to follow after the octet count, but a "-" follows.

IAW: the syslog framing is broken and indeed it is :-) You can disable
octet counted framing via a module parameter, but it is always a bit
dangerous to feed non-syslog data to the syslog receiver.

Rainer

El jue, 14 oct 2021 a las 15:35, John Chivian via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Group:
>
> Can someone help me understand why sending this exact plain text to an rsyslog network listener…
>
> 2021-10-14T08:26:31.444-00:00
>
> …results in this exact error message in the rsyslog log file?
>
> 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: delimiter is not SP but has ASCII value 45. [v8.2102.0]
>
>
> Yes, I know the priority and version are missing, but that doesn’t seem to explain why the error is occurring. Any help is greatly appreciated.
>
> The input configuration is as follows…
>
> input(type=“imptcp” name=“ptcp-51419-in” port=“51419” ruleset=“from_appname”)
>
>
> Thanks in advance,
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Odd Error Message from v8.2010 [ In reply to ]
Thank Rainer - I’ve experienced a sort of similar issue where messages starting with numeric characters cause the parse_json function to return a value of zero (message is a JSON object) when it is clearly NOT a JSON object. I posted about it a while ago but never saw a response.

I’ll check out the framing module parameter that disables the octet counting functionality as we’ve never had a need for such a thing in our environment.



> On Oct 14, 2021, at 12:16, Rainer Gerhards <rgerhards@hq.adiscon.com> wrote:
>
> I need to check the code, but as "framing error" is quoted, and "pri
> is missing" is said, I think the case is that 2021 is right at the
> start of the message. That triggers octet-counted framing (message
> terminated after n bytes/octets, not on LF). In that mode, a SP needs
> to follow after the octet count, but a "-" follows.
>
> IAW: the syslog framing is broken and indeed it is :-) You can disable
> octet counted framing via a module parameter, but it is always a bit
> dangerous to feed non-syslog data to the syslog receiver.
>
> Rainer
>
> El jue, 14 oct 2021 a las 15:35, John Chivian via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
>>
>> Group:
>>
>> Can someone help me understand why sending this exact plain text to an rsyslog network listener…
>>
>> 2021-10-14T08:26:31.444-00:00
>>
>> …results in this exact error message in the rsyslog log file?
>>
>> 2021-10-14T08:26:31.457923+00:00 log server rsyslogd: Framing Error in received TCP message from peer: (hostname) 127.0.0.1, (ip) 127.0.0.1: delimiter is not SP but has ASCII value 45. [v8.2102.0]
>>
>>
>> Yes, I know the priority and version are missing, but that doesn’t seem to explain why the error is occurring. Any help is greatly appreciated.
>>
>> The input configuration is as follows…
>>
>> input(type=“imptcp” name=“ptcp-51419-in” port=“51419” ruleset=“from_appname”)
>>
>>
>> Thanks in advance,
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.